Section 11 — DPDP Act, 2023
(1) A Data Principal shall have the right to obtain from the Data Fiduciary— (a) a summary of personal data being processed by the Data Fiduciary and the processing activities undertaken by the Data Fiduciary with respect to such personal data; (b) the identities of all Data Processors with whom the personal data has been shared by the Data Fiduciary, along with a description of the personal data so shared; and (c) any other information related to the personal data of such Data Principal and its processing, as may be prescribed. (2) A Data Principal may, in such manner and subject to such conditions and in such form as may be prescribed, seek the information specified in sub-section (1).
Source: Digital Personal Data Protection Act, 2023. Official text available at truconsent.io/resources/dpdp-act.pdf.
Section 11 gives Data Principals the right to see what data is held about them, for what purposes, and who it has been shared with. Unlike GDPR's Subject Access Right which requires providing a copy of the data, Section 11 provides a right to a 'summary' and a list of processors — not necessarily a verbatim copy of the dataset. This is a narrower right than GDPR Article 15. The request process and timelines are governed by Rule 14.
A user requests information from an e-commerce platform. A compliant response includes: (1) A summary of their data held — name, email, delivery addresses, purchase history, browsing data. (2) The purposes — order fulfilment, personalisation, fraud detection. (3) Processors who received the data — payment gateway, logistics partner, analytics vendor. The platform does not need to provide a raw database export.
Section 11 does not require giving the Data Principal a portable copy of their data in machine-readable format (that would be a data portability right, which the DPDP Act does not include). It requires a summary and a processor list, delivered within the Rule 14 timeline.